hello, i'm trying to use the cerbos pdp in a sidecar alongside my application container in a k8s pod. The issue i'm running into is that the

cerbos.sock

file that cerbos pdp is listening to in my shared volume is owned by

root

, but my application is running under the

node

user and group and is getting a

EACCES

error when trying to access the

cerbos.sock

file, how can i go about resolving this? I have verified by executing a shell as root user and manually changing the file ownership with `chown`in my application container to the

node

user and group resolves the error. Thanks

Hi @Vish, There is a configuration parameter

udsFileMode

available in the Cerbos configuration:

server:
  udsFileMode: 0o766 # UDSFileMode sets the file mode of the unix domain sockets created by the server.

Thanks for your reply @oguzhan. I did come across that configuration parameter. This only controls the file permissions as far as I understand, equivalent to a

chmod

, I guess i'd need the equivalent of a

chown

instead

Hey, since the two containers are running as different users, making the socket world-accessible by setting

udsFileMode

to

777

would work. Alternatively, you can use an init container to create the socket file in advance with the permissions you need. Cerbos only creates the socket file if it doesn't already exist.

Thanks @Charith (Cerbos), will give that a go